Claude Code Auto Mode Bypass via Zip-Delivered Python Module Shadowing

Technical Analysis

The attack entry point is Claude Code operating in unattended 'Auto Mode', which is trusted by Anthropic to autonomously evaluate and approve/deny risky commands without human confirmation. The attacker causes the agent to download and decompress a zip archive whose contents include a file named struct.py placed in the working directory; when subsequent code executes 'import base64' (which internally imports struct), Python's module resolution picks up the local malicious struct.py due to path shadowing rather than the trusted standard library module, achieving arbitrary code execution under the agent's process privileges. This crosses the boundary from a content/data-processing action (unzipping a file) into full code execution because the classifier evaluates surface-level command intent rather than tracking data provenance and downstream import behavior. Critically, the safety classifier that gates command execution not only failed to catch the malicious import step but in several trials actively denied Claude's own subsequent attempt to kill the compromised process, turning the safety control into an obstacle to remediation. The attacker gains code execution in the agent's runtime environment, with the actual blast radius depending on what credentials, network access, and filesystem the agent has, which is why lack of sandboxing is the primary aggravating factor.

Affected Systems

Claude Code

Detection Signatures

• Presence of unexpected struct.py, os.py, or other stdlib-named files in agent working directories or extracted archive contents
• Agent-initiated download and extraction of zip/tar archives from untrusted or unexpected sources during a coding session
• Process spawn events immediately following archive extraction and a benign-looking import statement (e.g., import base64/import struct)
• Safety classifier logs showing approval of process creation followed by denial of a terminate/kill command targeting the same process
• Outbound network connections initiated shortly after archive extraction in an agent sandbox with no prior user-authorized egress

Remediation Steps

1. 1

   Run unattended agents in isolated sandboxes

   Execute Claude Code and similar coding agents inside containers, VMs, or OS-level sandboxes with no access to host filesystem, home directories, SSH keys, or cloud credentials.

2. 2

   Restrict network egress

   Limit outbound network access from the agent runtime to an allowlist of known-good package registries and endpoints, blocking arbitrary downloads of archives from attacker-controlled or unexpected domains.

3. 3

   Do not rely on the model's own safety classifier as a sole control

   Treat Auto Mode or similar in-model approval systems as a supplementary heuristic, not a security boundary; enforce hard technical controls (sandboxing, egress restriction, least privilege) independently of classifier decisions.

4. 4

   Monitor and log agent actions with independent oversight

   Deploy external monitoring of agent command execution, file extraction, and process lifecycle events so that compromises can be detected and remediated even if the agent's internal safety system fails or actively blocks cleanup.

5. 5

   Harden Python import resolution

   Ensure agent execution environments do not allow local working-directory files to shadow standard library modules; consider running with sys.path configurations or -I isolated mode that prevent current-directory module shadowing.

6. 6

   Fail safe on classifier conflicts

   Ensure that when a safety classifier detects a compromise, cleanup and termination actions are never blocked; design approval logic so remediation commands are always prioritized over continuation of suspicious processes.